Segfault in the attr stack

(running git-next)

In the Gerrit repo I did
    $ echo "/plugins/commit-message-length-validator sub-default"

quoted

.gitattributes

    $ git status ":(attr:sub-default)"
Segmentation fault (core dumped)

Running this multiple times through gdb, this produces different back
traces as it seems that threads are involved? (So I don't attach a
back trace here)

Also notable are:
*** Error in `/usr/local/google/home/sbeller/bin/git': double free or
corruption (fasttop): 0x00007fffd80008f0 ***
*** Error in `/usr/local/google/home/sbeller/bin/git': double free or
corruption (fasttop): 0x00007ffff0001000 ***

When running another command `git status ":(attr:asdf)"`, I get
git: attr.c:634: prepare_attr_stack: Assertion `attr_stack->origin' failed.
git: attr.c:634: prepare_attr_stack: Assertion `attr_stack->origin' failed.
git: attr.c:634: prepare_attr_stack: Assertion `attr_stack->origin' failed.
git: attr.c:634: prepare_attr_stack: Assertion `attr_stack->origin' failed.
Aborted (core dumped)

The failing assertions are an indication that sb/pathspec-label is
using the attrs incorrectly or
jc/attr added tighter assertions than I was aware of.

Stefan